Kaspersky website hacked in fake antivirus attack

Scammers who try to trick victims into downloading fake antivirus software have struck the website of Kaspersky Lab, the leading antivirus vendor.

Robert McMillan
October 20, 2010

IDG News Service

Share

Twitter

Facebook

LinkedIn

Google Plus

Scammers who try to trick victims into downloading fake antivirus software have struck the website of Kaspersky Lab, the leading antivirus vendor.

Someone took advantage of a bug in a web program used by the Kasperskyusa.com website and reprogrammed it to try and trick visitors into downloading a fake product, Kaspersky confirmed yesterday (19 October). Kaspersky didn't identify the flaw, but said it was in a "third-party application" used by the website.

"As a result of the attack, users trying to download Kaspersky Lab's consumer products were redirected to a malicious website," the antivirus vendor said. The website caused a pop-up window to appear that simulated a virus scan of the user's PC, and offered to install an antivirus program that was in fact bogus.

This is a typical trick for fake-antivirus scammers, who are constantly looking for new ways to trick victims into buying their products. In the past they've been known to pose as legitimate online advertisers and then suddenly switch their ad inventory from legitimate-looking ads to these fake pop-up messages.

Security experts say the safest thing to do when one of these fake antivirus messages pops up is to simply kill the web browser. On Windows, this can be done by hitting ctrl-alt-delete and ending the browser process in the Task Manager.

According to Kaspersky, its website was redirecting users to the rogue antivirus site for about three-and-a-half hours Sunday. The company did a complete audit of its websites afterwards "to ensure they're running fully updated code".

Nobody's information was compromised in Sunday's attack, Kaspersky said. "However, Kaspersky Lab takes any attempt to compromise its security seriously," the company said. "Our researchers are currently working on identifying any possible consequences of the attack for affected users, and are available to provide help to remove the fake antivirus software."